@orvello/sdk 0.1.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -2,7 +2,7 @@
2
2
  var CONTRACT_SHA256 = "4efd4e4b669168c9cab5419fa04dd4e26a2029de2d4b10a59918e366189e1072";
3
3
 
4
4
  // src/diagnose.ts
5
- var SDK_VERSION = "0.1.0" ;
5
+ var SDK_VERSION = "0.2.1" ;
6
6
  function normalizeBaseUrl(raw) {
7
7
  const trimmed = raw.trim();
8
8
  if (!trimmed) throw new Error("Base URL cannot be empty");
@@ -181,6 +181,776 @@ function mapPaymentAccountToBankDetails(account) {
181
181
  };
182
182
  }
183
183
 
184
+ // src/route-index.generated.ts
185
+ var ROUTE_INDEX = {
186
+ "DELETE__api_amp_proxy_key": ["DELETE", "/api/amp-proxy/:key", "n", "public", 0],
187
+ "GET__api_amp_proxy__discover": ["GET", "/api/amp-proxy/_discover", "n", "public", 0],
188
+ "GET__api_amp_proxy_key": ["GET", "/api/amp-proxy/:key", "n", "public", 0],
189
+ "POST__api_amp_proxy_key": ["POST", "/api/amp-proxy/:key", "n", "public", 0],
190
+ "admin_vat_create_system_settings": ["POST", "/admin/vat/system-settings", "b", "frontend_permission_http", 4],
191
+ "admin_vat_get_company_settings_history": ["GET", "/admin/vat/company/:companyId/settings-history", "b", "frontend_permission_http", 1],
192
+ "admin_vat_get_system_settings": ["GET", "/admin/vat/system-settings", "b", "frontend_permission_http", 0],
193
+ "admin_vat_get_system_settings_history": ["GET", "/admin/vat/system-settings/history", "b", "frontend_permission_http", 2],
194
+ "admin_vat_update_company_settings": ["PUT", "/admin/vat/company/:companyId/settings", "b", "frontend_permission_http", 5],
195
+ "admin_vat_update_system_settings": ["PUT", "/admin/vat/system-settings/:id", "b", "frontend_permission_http", 5],
196
+ "app_info_get": ["GET", "/app-info", "b", "frontend_bearer_http", 2],
197
+ "app_info_health": ["GET", "/app-info/health", "n", "public", 0],
198
+ "app_info_manifest": ["GET", "/app-info/manifest", "n", "public", 0],
199
+ "app_info_own_permissions_get": ["GET", "/app-info/ownPermissions", "b", "frontend_bearer_http", 2],
200
+ "bookkeeping_assets_add_cost_component": ["POST", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 5],
201
+ "bookkeeping_assets_apply_sonderafa": ["POST", "/bookkeeping/assets/:assetId/sonderafa", "b", "frontend_permission_http", 5],
202
+ "bookkeeping_assets_create": ["POST", "/bookkeeping/assets", "b", "frontend_permission_http", 4],
203
+ "bookkeeping_assets_delete": ["DELETE", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
204
+ "bookkeeping_assets_delete_cost_component": ["DELETE", "/bookkeeping/assets/:assetId/cost-components/:componentId", "b", "frontend_permission_http", 1],
205
+ "bookkeeping_assets_dispose": ["POST", "/bookkeeping/assets/:assetId/dispose", "b", "frontend_permission_http", 5],
206
+ "bookkeeping_assets_finalize_depreciation": ["POST", "/bookkeeping/assets/depreciation/finalize", "b", "frontend_permission_http", 4],
207
+ "bookkeeping_assets_generate_depreciation": ["POST", "/bookkeeping/assets/depreciation/generate", "b", "frontend_permission_http", 4],
208
+ "bookkeeping_assets_get_by_id": ["GET", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 1],
209
+ "bookkeeping_assets_get_depreciation_records": ["GET", "/bookkeeping/assets/depreciation/records", "b", "frontend_permission_http", 2],
210
+ "bookkeeping_assets_get_sammelposten_pool": ["GET", "/bookkeeping/assets/sammelposten-pools/:poolId", "b", "frontend_permission_http", 1],
211
+ "bookkeeping_assets_iab_create": ["POST", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 4],
212
+ "bookkeeping_assets_iab_delete": ["DELETE", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
213
+ "bookkeeping_assets_iab_dissolve": ["POST", "/bookkeeping/assets/iab/:iabId/dissolve", "b", "frontend_permission_http", 5],
214
+ "bookkeeping_assets_iab_get": ["GET", "/bookkeeping/assets/iab/:iabId", "b", "frontend_permission_http", 1],
215
+ "bookkeeping_assets_iab_list": ["GET", "/bookkeeping/assets/iab", "b", "frontend_permission_http", 0],
216
+ "bookkeeping_assets_iab_reverse": ["POST", "/bookkeeping/assets/iab/:iabId/reverse", "b", "frontend_permission_http", 5],
217
+ "bookkeeping_assets_list_cost_components": ["GET", "/bookkeeping/assets/:assetId/cost-components", "b", "frontend_permission_http", 1],
218
+ "bookkeeping_assets_list_sammelposten_pools": ["GET", "/bookkeeping/assets/sammelposten-pools", "b", "frontend_permission_http", 0],
219
+ "bookkeeping_assets_search": ["GET", "/bookkeeping/assets", "b", "frontend_permission_http", 2],
220
+ "bookkeeping_assets_switch_to_linear": ["POST", "/bookkeeping/assets/:assetId/switch-to-linear", "b", "frontend_permission_http", 5],
221
+ "bookkeeping_assets_update": ["PUT", "/bookkeeping/assets/:assetId", "b", "frontend_permission_http", 5],
222
+ "bookkeeping_audit_logs": ["GET", "/bookkeeping/audit/logs", "b", "frontend_permission_http", 2],
223
+ "bookkeeping_capital_movements_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/cash-confirm", "b", "frontend_permission_http", 5],
224
+ "bookkeeping_capital_movements_confirm": ["POST", "/bookkeeping/capital-movements/:id/confirm", "b", "frontend_permission_http", 1],
225
+ "bookkeeping_capital_movements_create": ["POST", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 4],
226
+ "bookkeeping_capital_movements_delete": ["DELETE", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
227
+ "bookkeeping_capital_movements_get_by_id": ["GET", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 1],
228
+ "bookkeeping_capital_movements_kapitalkonto": ["GET", "/bookkeeping/capital-movements/kapitalkonto", "b", "frontend_permission_http", 2],
229
+ "bookkeeping_capital_movements_reverse": ["POST", "/bookkeeping/capital-movements/:id/reverse", "b", "frontend_permission_http", 5],
230
+ "bookkeeping_capital_movements_revoke_cash_confirm": ["POST", "/bookkeeping/capital-movements/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
231
+ "bookkeeping_capital_movements_search": ["GET", "/bookkeeping/capital-movements", "b", "frontend_permission_http", 2],
232
+ "bookkeeping_capital_movements_update": ["PATCH", "/bookkeeping/capital-movements/:id", "b", "frontend_permission_http", 5],
233
+ "bookkeeping_expenses_analyze_receipt": ["POST", "/bookkeeping/expenses/analyze-receipt", "b", "frontend_permission_http", 0],
234
+ "bookkeeping_expenses_bulk_confirm": ["POST", "/bookkeeping/expenses/bulk-confirm", "b", "frontend_permission_http", 4],
235
+ "bookkeeping_expenses_confirm": ["POST", "/bookkeeping/expenses/:id/confirm", "b", "frontend_permission_http", 1],
236
+ "bookkeeping_expenses_confirm_cash": ["POST", "/bookkeeping/expenses/:id/confirm-cash", "b", "frontend_permission_http", 5],
237
+ "bookkeeping_expenses_create": ["POST", "/bookkeeping/expenses", "b", "frontend_permission_http", 4],
238
+ "bookkeeping_expenses_create_external": ["POST", "/bookkeeping/expenses/external", "b", "unified_bearer", 4, ["expenses:write"]],
239
+ "bookkeeping_expenses_delete": ["DELETE", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
240
+ "bookkeeping_expenses_get_by_id": ["GET", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 1],
241
+ "bookkeeping_expenses_mark_as_asset": ["POST", "/bookkeeping/expenses/:id/mark-as-asset", "b", "frontend_permission_http", 5],
242
+ "bookkeeping_expenses_revoke_cash_confirm": ["POST", "/bookkeeping/expenses/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
243
+ "bookkeeping_expenses_search": ["GET", "/bookkeeping/expenses", "b", "frontend_permission_http", 2],
244
+ "bookkeeping_expenses_update": ["PUT", "/bookkeeping/expenses/:id", "b", "frontend_permission_http", 5],
245
+ "bookkeeping_expenses_upload_receipt": ["POST", "/bookkeeping/expenses/:id/upload-receipt", "b", "frontend_permission_http", 1],
246
+ "bookkeeping_iap_payouts_import": ["POST", "/bookkeeping/iap-payouts/import", "b", "frontend_permission_http", 4],
247
+ "bookkeeping_iap_payouts_list": ["GET", "/bookkeeping/iap-payouts", "b", "frontend_permission_http", 2],
248
+ "bookkeeping_income_tax_create_employment": ["POST", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 4],
249
+ "bookkeeping_income_tax_create_sonderausgaben": ["POST", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 4],
250
+ "bookkeeping_income_tax_create_steuerminderungen": ["POST", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 4],
251
+ "bookkeeping_income_tax_create_vorsorge": ["POST", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 4],
252
+ "bookkeeping_income_tax_create_werbungskosten": ["POST", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 4],
253
+ "bookkeeping_income_tax_delete_employment": ["DELETE", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
254
+ "bookkeeping_income_tax_delete_sonderausgaben": ["DELETE", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 1],
255
+ "bookkeeping_income_tax_delete_steuerminderungen": ["DELETE", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 1],
256
+ "bookkeeping_income_tax_delete_vorsorge": ["DELETE", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 1],
257
+ "bookkeeping_income_tax_delete_werbungskosten": ["DELETE", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 1],
258
+ "bookkeeping_income_tax_get_employment": ["GET", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 1],
259
+ "bookkeeping_income_tax_get_estimate": ["GET", "/bookkeeping/income-tax/estimate", "b", "frontend_permission_http", 2],
260
+ "bookkeeping_income_tax_get_settings": ["GET", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 0],
261
+ "bookkeeping_income_tax_get_summary": ["GET", "/bookkeeping/income-tax/summary", "b", "frontend_permission_http", 2],
262
+ "bookkeeping_income_tax_get_vorauszahlungen": ["GET", "/bookkeeping/income-tax/vorauszahlungen", "b", "frontend_permission_http", 2],
263
+ "bookkeeping_income_tax_list_employment": ["GET", "/bookkeeping/income-tax/employment", "b", "frontend_permission_http", 2],
264
+ "bookkeeping_income_tax_list_sonderausgaben": ["GET", "/bookkeeping/income-tax/sonderausgaben", "b", "frontend_permission_http", 2],
265
+ "bookkeeping_income_tax_list_steuerminderungen": ["GET", "/bookkeeping/income-tax/steuerminderungen", "b", "frontend_permission_http", 2],
266
+ "bookkeeping_income_tax_list_vorsorge": ["GET", "/bookkeeping/income-tax/vorsorge", "b", "frontend_permission_http", 2],
267
+ "bookkeeping_income_tax_list_werbungskosten": ["GET", "/bookkeeping/income-tax/werbungskosten", "b", "frontend_permission_http", 2],
268
+ "bookkeeping_income_tax_update_employment": ["PUT", "/bookkeeping/income-tax/employment/:id", "b", "frontend_permission_http", 5],
269
+ "bookkeeping_income_tax_update_sonderausgaben": ["PUT", "/bookkeeping/income-tax/sonderausgaben/:id", "b", "frontend_permission_http", 5],
270
+ "bookkeeping_income_tax_update_steuerminderungen": ["PUT", "/bookkeeping/income-tax/steuerminderungen/:id", "b", "frontend_permission_http", 5],
271
+ "bookkeeping_income_tax_update_vorsorge": ["PUT", "/bookkeeping/income-tax/vorsorge/:id", "b", "frontend_permission_http", 5],
272
+ "bookkeeping_income_tax_update_werbungskosten": ["PUT", "/bookkeeping/income-tax/werbungskosten/:id", "b", "frontend_permission_http", 5],
273
+ "bookkeeping_income_tax_upsert_settings": ["POST", "/bookkeeping/income-tax/settings", "b", "frontend_permission_http", 4],
274
+ "bookkeeping_locks_get_state": ["GET", "/bookkeeping/locks/state", "b", "frontend_permission_http", 0],
275
+ "bookkeeping_locks_overview": ["GET", "/bookkeeping/locks/overview", "b", "frontend_permission_http", 2],
276
+ "bookkeeping_locks_recommendation": ["GET", "/bookkeeping/locks/recommendation", "b", "frontend_permission_http", 2],
277
+ "bookkeeping_locks_set": ["POST", "/bookkeeping/locks/set", "b", "frontend_permission_http", 4],
278
+ "bookkeeping_payments_create_manual_external": ["POST", "/bookkeeping/payments/external/manual", "b", "unified_bearer", 4, ["payments:write"]],
279
+ "bookkeeping_payments_list_accounts_external": ["GET", "/bookkeeping/payments/external/accounts", "b", "unified_bearer", 2, ["payments:read"]],
280
+ "bookkeeping_payments_settle_invoice_external": ["POST", "/bookkeeping/payments/external/settle-invoice", "b", "unified_bearer", 4, ["payments:write", "invoices:write"]],
281
+ "bookkeeping_reports_asset_register": ["GET", "/bookkeeping/reports/assets", "b", "frontend_permission_http", 2],
282
+ "bookkeeping_reports_category_breakdown": ["GET", "/bookkeeping/reports/category-breakdown", "b", "frontend_permission_http", 2],
283
+ "bookkeeping_reports_euer": ["GET", "/bookkeeping/reports/euer", "b", "frontend_permission_http", 2],
284
+ "bookkeeping_reports_monthly_trend": ["GET", "/bookkeeping/reports/monthly-trend", "b", "frontend_permission_http", 2],
285
+ "bookkeeping_reports_summary": ["GET", "/bookkeeping/reports/summary", "b", "frontend_permission_http", 2],
286
+ "bookkeeping_reports_vat_periods": ["GET", "/bookkeeping/reports/vat/periods", "b", "frontend_permission_http", 0],
287
+ "bookkeeping_reports_vat_status": ["GET", "/bookkeeping/reports/vat/status", "b", "frontend_permission_http", 0],
288
+ "bookkeeping_reports_vat_ustva": ["GET", "/bookkeeping/reports/vat/ustva", "b", "frontend_permission_http", 2],
289
+ "bookkeeping_reports_vendor_breakdown": ["GET", "/bookkeeping/reports/vendor-breakdown", "b", "frontend_permission_http", 2],
290
+ "bookkeeping_revenues_analyze_receipt": ["POST", "/bookkeeping/revenues/analyze-receipt", "b", "frontend_permission_http", 0],
291
+ "bookkeeping_revenues_bulk_confirm": ["POST", "/bookkeeping/revenues/bulk-confirm", "b", "frontend_permission_http", 4],
292
+ "bookkeeping_revenues_confirm": ["POST", "/bookkeeping/revenues/:id/confirm", "b", "frontend_permission_http", 1],
293
+ "bookkeeping_revenues_confirm_cash": ["POST", "/bookkeeping/revenues/:id/confirm-cash", "b", "frontend_permission_http", 5],
294
+ "bookkeeping_revenues_create": ["POST", "/bookkeeping/revenues", "b", "frontend_permission_http", 4],
295
+ "bookkeeping_revenues_create_external": ["POST", "/bookkeeping/revenues/external", "b", "unified_bearer", 4, ["revenues:write"]],
296
+ "bookkeeping_revenues_delete": ["DELETE", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
297
+ "bookkeeping_revenues_get_by_id": ["GET", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 1],
298
+ "bookkeeping_revenues_invoice_adjustment_external": ["POST", "/bookkeeping/revenues/external/invoice-adjustment", "b", "unified_bearer", 4, ["revenues:write"]],
299
+ "bookkeeping_revenues_revoke_cash_confirm": ["POST", "/bookkeeping/revenues/:id/revoke-cash-confirm", "b", "frontend_permission_http", 5],
300
+ "bookkeeping_revenues_search": ["GET", "/bookkeeping/revenues", "b", "frontend_permission_http", 2],
301
+ "bookkeeping_revenues_update": ["PUT", "/bookkeeping/revenues/:id", "b", "frontend_permission_http", 5],
302
+ "bookkeeping_revenues_upload_receipt": ["POST", "/bookkeeping/revenues/:id/upload-receipt", "b", "frontend_permission_http", 1],
303
+ "bookkeeping_tax_params_create": ["POST", "/bookkeeping/tax-params", "b", "frontend_permission_http", 4],
304
+ "bookkeeping_tax_params_health": ["GET", "/bookkeeping/tax-params/health", "b", "frontend_permission_http", 0],
305
+ "bookkeeping_tax_params_history": ["GET", "/bookkeeping/tax-params/:key/history", "b", "frontend_permission_http", 1],
306
+ "bookkeeping_tax_params_list": ["GET", "/bookkeeping/tax-params", "b", "frontend_permission_http", 2],
307
+ "bookkeeping_tax_params_sync": ["POST", "/bookkeeping/tax-params/sync", "b", "frontend_permission_http", 0],
308
+ "bookkeeping_tax_params_update": ["PATCH", "/bookkeeping/tax-params/:id", "b", "frontend_permission_http", 5],
309
+ "currency_rates_get": ["GET", "/currency-rates/:fromCurrency/:toCurrency", "k", "x_api_key_http", 3],
310
+ "customer_companies_create": ["POST", "/customer-companies/create", "b", "frontend_permission_http", 4],
311
+ "customer_companies_create_external": ["POST", "/customer-companies/external", "b", "unified_bearer", 4, ["companies:write"]],
312
+ "customer_companies_delete": ["DELETE", "/customer-companies/delete/:companyId", "b", "frontend_permission_http", 1],
313
+ "customer_companies_delete_external": ["DELETE", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:delete"]],
314
+ "customer_companies_employee_assignments_by_company_id": ["GET", "/customer-companies/employee-assignments/byCompanyId/:companyId", "b", "frontend_permission_http", 3],
315
+ "customer_companies_employee_assignments_by_employee_id": ["GET", "/customer-companies/employee-assignments/byEmployeeId/:employeeId", "b", "frontend_permission_http", 3],
316
+ "customer_companies_employee_assignments_create": ["POST", "/customer-companies/employee-assignments/create", "b", "frontend_permission_http", 4],
317
+ "customer_companies_employee_assignments_update": ["PUT", "/customer-companies/employee-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
318
+ "customer_companies_employees_create": ["POST", "/customer-companies/employees/create", "b", "frontend_permission_http", 4],
319
+ "customer_companies_employees_delete": ["DELETE", "/customer-companies/employees/delete/:employeeId", "b", "frontend_permission_http", 1],
320
+ "customer_companies_employees_get_by_id": ["GET", "/customer-companies/employees/byId/:employeeId", "b", "frontend_permission_http", 1],
321
+ "customer_companies_employees_search": ["GET", "/customer-companies/employees/search", "b", "frontend_permission_http", 2],
322
+ "customer_companies_employees_update": ["PUT", "/customer-companies/employees/update/:employeeId", "b", "frontend_permission_http", 5],
323
+ "customer_companies_get_by_id": ["GET", "/customer-companies/byId/:companyId", "b", "frontend_permission_http", 1],
324
+ "customer_companies_get_by_id_external": ["GET", "/customer-companies/external/:companyId", "b", "unified_bearer", 1, ["companies:read"]],
325
+ "customer_companies_get_full_by_id": ["GET", "/customer-companies/byId/:companyId/full", "b", "frontend_permission_http", 3],
326
+ "customer_companies_search": ["GET", "/customer-companies/search", "b", "frontend_permission_http", 2],
327
+ "customer_companies_search_external": ["GET", "/customer-companies/external", "b", "unified_bearer", 2, ["companies:read"]],
328
+ "customer_companies_update": ["PUT", "/customer-companies/update/:companyId", "b", "frontend_permission_http", 5],
329
+ "customer_companies_update_external": ["PUT", "/customer-companies/external/:companyId", "b", "unified_bearer", 5, ["companies:write"]],
330
+ "documents_assign": ["POST", "/documents/admin/assign", "b", "frontend_permission_http", 4],
331
+ "documents_create": ["POST", "/documents/admin/create", "b", "frontend_permission_http", 4],
332
+ "documents_delete": ["DELETE", "/documents/admin/delete/:documentId", "b", "frontend_permission_http", 3],
333
+ "documents_delete_assignment": ["DELETE", "/documents/admin/assignments/:assignmentId", "b", "frontend_permission_http", 1],
334
+ "documents_download_url": ["GET", "/documents/admin/byId/:documentId/download-url", "b", "frontend_permission_http", 3],
335
+ "documents_get_by_id": ["GET", "/documents/admin/byId/:documentId", "b", "frontend_permission_http", 1],
336
+ "documents_get_full_by_id": ["GET", "/documents/admin/byId/:documentId/full", "b", "frontend_permission_http", 1],
337
+ "documents_search": ["GET", "/documents/admin/search", "b", "frontend_permission_http", 2],
338
+ "documents_set_lock": ["PUT", "/documents/admin/lock/:documentId", "b", "frontend_permission_http", 5],
339
+ "documents_stream": ["GET", "/documents/admin/stream/:documentId", "b", "frontend_permission_http", 3],
340
+ "dunning_get_settings_external": ["GET", "/invoices/external/dunning/settings", "b", "unified_bearer", 2, ["invoices:read"]],
341
+ "dunning_issue_external": ["POST", "/invoices/external/dunning/:invoiceId/issue", "b", "unified_bearer", 5, ["invoices:write"]],
342
+ "dunning_notice_download_external": ["GET", "/invoices/external/dunning/notices/:noticeId/download", "b", "unified_bearer", 1, ["invoices:read"]],
343
+ "dunning_notice_pdf_external": ["GET", "/invoices/external/dunning/notices/:noticeId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
344
+ "dunning_preview_external": ["POST", "/invoices/external/dunning/:invoiceId/preview", "b", "unified_bearer", 5, ["invoices:read"]],
345
+ "dunning_suggestions_external": ["GET", "/invoices/external/dunning/suggestions", "b", "unified_bearer", 2, ["invoices:read"]],
346
+ "dunning_update_settings_external": ["PUT", "/invoices/external/dunning/settings", "b", "unified_bearer", 4, ["invoices:write"]],
347
+ "enterprise_onboarding_complete_step": ["POST", "/apps/enterprise/onboarding/complete-step", "b", "frontend_permission_http", 4],
348
+ "enterprise_onboarding_skip_step": ["POST", "/apps/enterprise/onboarding/skip-step", "b", "frontend_permission_http", 4],
349
+ "enterprise_onboarding_state_get": ["GET", "/apps/enterprise/onboarding/state", "b", "frontend_permission_http", 2],
350
+ "entitlements_assign": ["POST", "/entitlements", "b", "unified_bearer", 4, ["entitlements:write"]],
351
+ "entitlements_context_get_by_shop_assignment": ["GET", "/entitlements/context/by-shop-assignment/:shopAssignmentId", "b", "unified_bearer", 1, ["entitlements:read"]],
352
+ "entitlements_getAll": ["GET", "/entitlements/getAll", "b", "unified_bearer", 2, ["entitlements:read"]],
353
+ "entitlements_getAssigned": ["GET", "/entitlements/assigned", "b", "unified_bearer", 2, ["entitlements:read"]],
354
+ "entitlements_getById": ["GET", "/entitlements/:id", "b", "unified_bearer", 1, ["entitlements:read"]],
355
+ "entitlements_getUserEntitlements": ["GET", "/entitlements/user/:userId", "b", "unified_bearer", 1, ["entitlements:read"]],
356
+ "entitlements_get_state": ["GET", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:read"]],
357
+ "entitlements_list": ["GET", "/entitlements", "b", "unified_bearer", 2, ["entitlements:read"]],
358
+ "entitlements_revoke": ["DELETE", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 1, ["entitlements:write"]],
359
+ "entitlements_update_state": ["PUT", "/entitlements/:userId/:type/:identifier", "b", "unified_bearer", 5, ["entitlements:read", "entitlements:write"]],
360
+ "entitlements_usage_overages_pull": ["GET", "/entitlements/usage-overages", "b", "unified_bearer", 2, ["entitlements:read"]],
361
+ "exports_datev_buchungsstapel": ["GET", "/exports/bookkeeping/datev/buchungsstapel", "b", "frontend_permission_http", 0],
362
+ "exports_datev_metadata": ["GET", "/exports/bookkeeping/datev/metadata", "b", "frontend_permission_http", 0],
363
+ "invoice_dunning_delete_notice": ["DELETE", "/invoices/dunning/:invoiceId/notices/:noticeId", "b", "frontend_permission_http", 1],
364
+ "invoice_dunning_get_settings": ["GET", "/invoices/dunning/settings", "b", "frontend_permission_http", 2],
365
+ "invoice_dunning_issue": ["POST", "/invoices/dunning/:invoiceId/issue", "b", "frontend_permission_http", 5],
366
+ "invoice_dunning_list_notices": ["GET", "/invoices/dunning/:invoiceId/notices", "b", "frontend_permission_http", 1],
367
+ "invoice_dunning_notice_download": ["GET", "/invoices/dunning/notices/:noticeId/download", "b", "frontend_permission_http", 1],
368
+ "invoice_dunning_notice_pdf": ["GET", "/invoices/dunning/notices/:noticeId/pdf", "b", "frontend_permission_http", 1],
369
+ "invoice_dunning_preview": ["POST", "/invoices/dunning/:invoiceId/preview", "b", "frontend_permission_http", 5],
370
+ "invoice_dunning_suggestions": ["GET", "/invoices/dunning/suggestions", "b", "frontend_permission_http", 2],
371
+ "invoice_dunning_update_settings": ["PUT", "/invoices/dunning/settings", "b", "frontend_permission_http", 4],
372
+ "invoices_analysis": ["GET", "/invoices/:invoiceId/analysis", "b", "frontend_permission_http", 1],
373
+ "invoices_create_external": ["POST", "/invoices/external", "b", "unified_bearer", 4, ["invoices:write"]],
374
+ "invoices_create_manual": ["POST", "/invoices/manual", "b", "frontend_bearer_http", 4],
375
+ "invoices_credit_note_issue": ["POST", "/invoices/:invoiceId/credit-note/issue", "b", "frontend_permission_http", 5],
376
+ "invoices_credit_note_issue_external": ["POST", "/invoices/external/:invoiceId/credit-note/issue", "b", "unified_bearer", 5, ["invoices:publish"]],
377
+ "invoices_credit_note_preview": ["POST", "/invoices/:invoiceId/credit-note/preview", "b", "frontend_permission_http", 5],
378
+ "invoices_credit_note_preview_external": ["POST", "/invoices/external/:invoiceId/credit-note/preview", "b", "unified_bearer", 5, ["invoices:write"]],
379
+ "invoices_delete": ["DELETE", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
380
+ "invoices_delete_external": ["DELETE", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:delete"]],
381
+ "invoices_download_pdf": ["GET", "/invoices/:invoiceId/download", "n", "public", 3],
382
+ "invoices_download_pdf_external": ["GET", "/invoices/external/:invoiceId/download", "b", "unified_bearer", 1, ["invoices:read"]],
383
+ "invoices_get_by_id": ["GET", "/invoices/:invoiceId", "b", "frontend_bearer_http", 1],
384
+ "invoices_get_by_id_external": ["GET", "/invoices/external/:invoiceId", "b", "unified_bearer", 1, ["invoices:read"]],
385
+ "invoices_list_overdue": ["GET", "/invoices/overdue", "b", "frontend_permission_http", 2],
386
+ "invoices_list_pending": ["GET", "/invoices/pending", "b", "frontend_permission_http", 2],
387
+ "invoices_overdue_external": ["GET", "/invoices/external/overdue", "b", "unified_bearer", 2, ["invoices:read"]],
388
+ "invoices_payment_reconciliation": ["GET", "/invoices/:invoiceId/payment-reconciliation", "b", "frontend_permission_http", 1],
389
+ "invoices_pending_external": ["GET", "/invoices/external/pending", "b", "unified_bearer", 2, ["invoices:read"]],
390
+ "invoices_repair_pdf": ["POST", "/invoices/:invoiceId/repair-pdf", "b", "frontend_bearer_http", 1],
391
+ "invoices_search": ["GET", "/invoices", "b", "frontend_bearer_http", 2],
392
+ "invoices_search_external": ["GET", "/invoices/external", "b", "unified_bearer", 2, ["invoices:read"]],
393
+ "invoices_send_email_external": ["POST", "/invoices/external/:invoiceId/send-email", "b", "unified_bearer", 5, ["invoices:write"]],
394
+ "invoices_status_policy": ["GET", "/invoices/:invoiceId/status-policy", "b", "frontend_bearer_http", 1],
395
+ "invoices_status_policy_external": ["GET", "/invoices/external/:invoiceId/status-policy", "b", "unified_bearer", 1, ["invoices:read"]],
396
+ "invoices_update_status": ["PUT", "/invoices/:invoiceId/status", "b", "frontend_bearer_http", 5],
397
+ "invoices_update_status_external": ["PUT", "/invoices/external/:invoiceId/status", "b", "unified_bearer", 5, ["invoices:write"]],
398
+ "invoices_view_pdf": ["GET", "/invoices/:invoiceId/pdf", "n", "public", 3],
399
+ "invoices_view_pdf_external": ["GET", "/invoices/external/:invoiceId/pdf", "b", "unified_bearer", 1, ["invoices:read"]],
400
+ "logs_delete": ["DELETE", "/app-logs/delete/:logId", "b", "frontend_permission_http", 1],
401
+ "logs_delete_bulk": ["DELETE", "/app-logs/delete/mass/:logIds", "b", "frontend_permission_http", 1],
402
+ "logs_search": ["GET", "/app-logs/search", "b", "frontend_permission_http", 2],
403
+ "managing_companies_api_keys_by_id": ["GET", "/managing-companies/api-keys/byId/:apiKeyId", "b", "frontend_permission_http", 1],
404
+ "managing_companies_api_keys_create": ["POST", "/managing-companies/api-keys/create", "b", "frontend_permission_http", 4],
405
+ "managing_companies_api_keys_delete": ["DELETE", "/managing-companies/api-keys/delete/:apiKeyId", "b", "frontend_permission_http", 1],
406
+ "managing_companies_api_keys_list": ["GET", "/managing-companies/api-keys/list", "b", "frontend_permission_http", 2],
407
+ "managing_companies_api_keys_revoke": ["POST", "/managing-companies/api-keys/revoke/:apiKeyId", "b", "frontend_permission_http", 1],
408
+ "managing_companies_api_keys_update": ["PUT", "/managing-companies/api-keys/update/:apiKeyId", "b", "frontend_permission_http", 5],
409
+ "managing_companies_cost_centers_by_id": ["GET", "/managing-companies/cost-centers/byId/:id", "b", "frontend_permission_http", 1],
410
+ "managing_companies_cost_centers_by_ids": ["GET", "/managing-companies/cost-centers/by-ids", "b", "frontend_permission_http", 2],
411
+ "managing_companies_cost_centers_create": ["POST", "/managing-companies/cost-centers/create", "b", "frontend_permission_http", 4],
412
+ "managing_companies_cost_centers_delete": ["DELETE", "/managing-companies/cost-centers/delete/:id", "b", "frontend_permission_http", 1],
413
+ "managing_companies_cost_centers_list": ["GET", "/managing-companies/cost-centers/list/:managingCompanyId", "b", "frontend_permission_http", 3],
414
+ "managing_companies_cost_centers_logos_delete": ["DELETE", "/managing-companies/cost-centers/logos/delete/:id/:mode", "b", "frontend_permission_http", 1],
415
+ "managing_companies_cost_centers_logos_settings": ["GET", "/managing-companies/cost-centers/logos/settings/:id", "b", "frontend_permission_http", 1],
416
+ "managing_companies_cost_centers_logos_upload": ["POST", "/managing-companies/cost-centers/logos/upload/:id/:mode", "b", "frontend_permission_http", 1],
417
+ "managing_companies_cost_centers_logos_urls": ["GET", "/managing-companies/cost-centers/logos/urls/:id", "b", "frontend_permission_http", 1],
418
+ "managing_companies_cost_centers_my": ["GET", "/managing-companies/cost-centers/my/:managingCompanyId", "b", "frontend_permission_http", 1],
419
+ "managing_companies_cost_centers_update": ["PUT", "/managing-companies/cost-centers/update/:id", "b", "frontend_permission_http", 5],
420
+ "managing_companies_create": ["POST", "/managing-companies", "b", "frontend_permission_http", 4],
421
+ "managing_companies_current_external": ["GET", "/managing-companies/external/current", "b", "unified_bearer", 2, ["companies:read"]],
422
+ "managing_companies_delete": ["DELETE", "/managing-companies/:id", "b", "frontend_permission_http", 1],
423
+ "managing_companies_get_by_id": ["GET", "/managing-companies/:id", "b", "frontend_permission_http", 1],
424
+ "managing_companies_invites_accept": ["POST", "/managing-companies/invites/accept/:token", "b", "frontend_bearer_http", 1],
425
+ "managing_companies_invites_cancel": ["DELETE", "/managing-companies/invites/cancel/:inviteId", "b", "frontend_bearer_http", 5],
426
+ "managing_companies_invites_pending_company": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId", "b", "frontend_permission_http", 3],
427
+ "managing_companies_invites_pending_company_preview": ["GET", "/managing-companies/invites/pending/company/:managingCompanyId/preview", "b", "frontend_bearer_http", 3],
428
+ "managing_companies_invites_pending_user": ["GET", "/managing-companies/invites/pending/user", "b", "frontend_permission_http", 2],
429
+ "managing_companies_invites_reject": ["POST", "/managing-companies/invites/reject/:token", "b", "frontend_bearer_http", 1],
430
+ "managing_companies_invoice_layouts_catalog": ["GET", "/managing-companies/invoice-layouts/catalog", "b", "frontend_bearer_http", 2],
431
+ "managing_companies_invoice_layouts_effective": ["GET", "/managing-companies/invoice-layouts/effective", "b", "frontend_bearer_http", 2],
432
+ "managing_companies_invoice_layouts_preview": ["GET", "/managing-companies/invoice-layouts/preview", "b", "frontend_bearer_http", 2],
433
+ "managing_companies_invoice_layouts_previews": ["GET", "/managing-companies/invoice-layouts/previews", "b", "frontend_bearer_http", 2],
434
+ "managing_companies_invoice_templates_archive": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/archive", "b", "frontend_bearer_http", 1],
435
+ "managing_companies_invoice_templates_create": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/create", "b", "frontend_bearer_http", 5],
436
+ "managing_companies_invoice_templates_duplicate": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/:templateId/duplicate", "b", "frontend_bearer_http", 5],
437
+ "managing_companies_invoice_templates_from_invoice": ["POST", "/managing-companies/invoice-templates/:managingCompanyId/from-invoice", "b", "frontend_bearer_http", 5],
438
+ "managing_companies_invoice_templates_get": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 1],
439
+ "managing_companies_invoice_templates_list": ["GET", "/managing-companies/invoice-templates/:managingCompanyId/list", "b", "frontend_bearer_http", 3],
440
+ "managing_companies_invoice_templates_update": ["PUT", "/managing-companies/invoice-templates/:managingCompanyId/:templateId", "b", "frontend_bearer_http", 5],
441
+ "managing_companies_invoice_transparency_context": ["GET", "/managing-companies/invoice-transparency/:managingCompanyId/context", "b", "frontend_bearer_http", 1],
442
+ "managing_companies_invoice_transparency_quote": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/quote", "b", "frontend_bearer_http", 5],
443
+ "managing_companies_item_type_configs_archive": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value/archive", "b", "frontend_bearer_http", 1],
444
+ "managing_companies_item_type_configs_create": ["POST", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs", "b", "frontend_bearer_http", 5],
445
+ "managing_companies_item_type_configs_update": ["PUT", "/managing-companies/invoice-transparency/:managingCompanyId/item-type-configs/:value", "b", "frontend_bearer_http", 5],
446
+ "managing_companies_list": ["GET", "/managing-companies", "b", "frontend_permission_http", 2],
447
+ "managing_companies_logos_delete": ["DELETE", "/managing-companies/logos/delete/:mode", "b", "frontend_bearer_http", 1],
448
+ "managing_companies_logos_set_mode": ["PUT", "/managing-companies/logos/mode", "b", "frontend_bearer_http", 4],
449
+ "managing_companies_logos_settings": ["GET", "/managing-companies/logos/settings", "b", "frontend_bearer_http", 2],
450
+ "managing_companies_logos_upload": ["POST", "/managing-companies/logos/upload/:mode", "b", "frontend_bearer_http", 1],
451
+ "managing_companies_logos_urls": ["GET", "/managing-companies/logos/urls", "b", "frontend_bearer_http", 2],
452
+ "managing_companies_selected_current": ["GET", "/managing-companies/selected/current", "b", "frontend_bearer_http", 2],
453
+ "managing_companies_selected_set": ["POST", "/managing-companies/selected/set/:companyId", "b", "frontend_bearer_http", 1],
454
+ "managing_companies_update": ["PUT", "/managing-companies/:id", "b", "frontend_permission_http", 5],
455
+ "managing_companies_user_assignments_assign": ["POST", "/managing-companies/user-assignments/assign", "b", "frontend_permission_http", 4],
456
+ "managing_companies_user_assignments_cost_centers_add": ["POST", "/managing-companies/user-assignments/cost-centers/add", "b", "frontend_permission_http", 4],
457
+ "managing_companies_user_assignments_cost_centers_remove": ["POST", "/managing-companies/user-assignments/cost-centers/remove", "b", "frontend_permission_http", 4],
458
+ "managing_companies_user_assignments_list": ["GET", "/managing-companies/user-assignments/list/:companyId", "b", "frontend_permission_http", 3],
459
+ "managing_companies_user_assignments_revoke": ["POST", "/managing-companies/user-assignments/revoke", "b", "frontend_permission_http", 4],
460
+ "managing_companies_user_assignments_update": ["PUT", "/managing-companies/user-assignments/update/:assignmentId", "b", "frontend_permission_http", 5],
461
+ "managing_companies_vat_settings_decision_upsert": ["PUT", "/managing-companies/vat-settings/:companyId/decisions/:decisionKey", "b", "frontend_bearer_http", 5],
462
+ "managing_companies_vat_settings_get": ["GET", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 1],
463
+ "managing_companies_vat_settings_tax_alerts": ["GET", "/managing-companies/vat-settings/:companyId/tax-alerts", "b", "frontend_bearer_http", 1],
464
+ "managing_companies_vat_settings_upsert": ["POST", "/managing-companies/vat-settings/:companyId", "b", "frontend_bearer_http", 5],
465
+ "oauth2_clients_audit": ["GET", "/oauth/clients/audit/:id", "b", "frontend_bearer_http", 3],
466
+ "oauth2_clients_create": ["POST", "/oauth/clients/create", "b", "frontend_bearer_http", 4],
467
+ "oauth2_clients_list": ["GET", "/oauth/clients/list", "b", "frontend_bearer_http", 2],
468
+ "oauth2_clients_revoke": ["DELETE", "/oauth/clients/revoke/:id", "b", "frontend_bearer_http", 1],
469
+ "oauth2_clients_update": ["PUT", "/oauth/clients/update/:id", "b", "frontend_bearer_http", 5],
470
+ "oauth2_external_clients_create": ["POST", "/oauth/clients/external", "k", "x_api_key_https", 4],
471
+ "oauth2_external_clients_delete": ["DELETE", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
472
+ "oauth2_external_clients_get": ["GET", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 1],
473
+ "oauth2_external_clients_list": ["GET", "/oauth/clients/external/list", "k", "x_api_key_https", 2],
474
+ "oauth2_external_clients_retire": ["POST", "/oauth/clients/external/:idOrClientId/retire", "k", "x_api_key_https", 1],
475
+ "oauth2_external_clients_revoke": ["POST", "/oauth/clients/external/:idOrClientId/revoke", "k", "x_api_key_https", 1],
476
+ "oauth2_external_clients_rollback": ["POST", "/oauth/clients/external/:idOrClientId/rollback", "k", "x_api_key_https", 1],
477
+ "oauth2_external_clients_rotate": ["POST", "/oauth/clients/external/:idOrClientId/rotate", "k", "x_api_key_https", 1],
478
+ "oauth2_external_clients_update": ["PUT", "/oauth/clients/external/:idOrClientId", "k", "x_api_key_https", 5],
479
+ "oauth2_revoke": ["POST", "/oauth/revoke", "n", "public", 0],
480
+ "oauth2_scopes_list": ["GET", "/oauth/scopes", "b", "frontend_bearer_http", 2],
481
+ "oauth2_token": ["POST", "/oauth/token", "n", "public", 0],
482
+ "payments_allocate": ["POST", "/bookkeeping/payments/allocate/:paymentId", "b", "frontend_permission_http", 5],
483
+ "payments_allocation_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reversal-preview", "b", "frontend_permission_http", 1],
484
+ "payments_allocation_reverse": ["POST", "/bookkeeping/payments/:paymentId/allocations/:allocationId/reverse", "b", "frontend_permission_http", 1],
485
+ "payments_apply_discount": ["POST", "/bookkeeping/payments/:paymentId/discount", "b", "frontend_permission_http", 5],
486
+ "payments_archive_account": ["POST", "/bookkeeping/payments/accounts/:accountId/archive", "b", "frontend_permission_http", 1],
487
+ "payments_book": ["POST", "/bookkeeping/payments/:paymentId/book", "b", "frontend_permission_http", 5],
488
+ "payments_booking_payment_suggestions": ["GET", "/bookkeeping/payments/booking-match/:targetType/:targetId/payment-suggestions", "b", "frontend_permission_http", 3],
489
+ "payments_cashbook": ["GET", "/bookkeeping/payments/cashbook", "b", "frontend_permission_http", 2],
490
+ "payments_confirm_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/confirm", "b", "frontend_permission_http", 4],
491
+ "payments_create_account": ["POST", "/bookkeeping/payments/accounts/create", "b", "frontend_permission_http", 4],
492
+ "payments_create_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 4],
493
+ "payments_create_import_profile": ["POST", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 4],
494
+ "payments_create_manual": ["POST", "/bookkeeping/payments/manual", "b", "frontend_permission_http", 4],
495
+ "payments_delete": ["DELETE", "/bookkeeping/payments/:paymentId", "b", "frontend_permission_http", 1],
496
+ "payments_delete_account": ["DELETE", "/bookkeeping/payments/accounts/:accountId", "b", "frontend_permission_http", 1],
497
+ "payments_download_csv_template": ["GET", "/bookkeeping/payments/import/csv/template/:profileKey", "b", "frontend_permission_http", 1],
498
+ "payments_get_account_by_id": ["GET", "/bookkeeping/payments/accounts/bdId/:accountId", "b", "frontend_permission_http", 1],
499
+ "payments_import_csv": ["POST", "/bookkeeping/payments/import/csv", "b", "frontend_permission_http", 4],
500
+ "payments_import_csv_preview": ["POST", "/bookkeeping/payments/import/csv/preview", "b", "frontend_permission_http", 4],
501
+ "payments_list_accounts": ["GET", "/bookkeeping/payments/accounts", "b", "frontend_permission_http", 2],
502
+ "payments_list_balance_snapshots": ["GET", "/bookkeeping/payments/snapshots", "b", "frontend_permission_http", 2],
503
+ "payments_list_csv_profiles": ["GET", "/bookkeeping/payments/import/csv/profiles", "b", "frontend_permission_http", 0],
504
+ "payments_list_fee_proposals": ["GET", "/bookkeeping/payments/fee-proposals", "b", "frontend_permission_http", 2],
505
+ "payments_list_import_profiles": ["GET", "/bookkeeping/payments/import/profiles", "b", "frontend_permission_http", 2],
506
+ "payments_match_suggestions": ["GET", "/bookkeeping/payments/match/:paymentId/suggestions", "b", "frontend_permission_http", 3],
507
+ "payments_paypal_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/sync", "b", "frontend_permission_http", 3],
508
+ "payments_paypal_webhook_deregister": ["DELETE", "/bookkeeping/payments/accounts/:accountId/paypal/webhook", "b", "frontend_permission_http", 1],
509
+ "payments_paypal_webhook_receive": ["POST", "/bookkeeping/payments/public/paypal/webhook", "n", "public", 0],
510
+ "payments_paypal_webhook_register": ["POST", "/bookkeeping/payments/accounts/:accountId/paypal/webhook/register", "b", "frontend_permission_http", 5],
511
+ "payments_record_fee": ["POST", "/bookkeeping/payments/:paymentId/fee", "b", "frontend_permission_http", 5],
512
+ "payments_reject_fee_proposals": ["POST", "/bookkeeping/payments/fee-proposals/reject", "b", "frontend_permission_http", 4],
513
+ "payments_reversal_preview": ["GET", "/bookkeeping/payments/:paymentId/reversal-preview", "b", "frontend_permission_http", 1],
514
+ "payments_reverse": ["POST", "/bookkeeping/payments/:paymentId/reverse", "b", "frontend_permission_http", 5],
515
+ "payments_search": ["GET", "/bookkeeping/payments/search", "b", "frontend_permission_http", 2],
516
+ "payments_sumup_oauth_callback": ["GET", "/bookkeeping/payments/public/sumup/oauth/callback", "n", "public", 2],
517
+ "payments_sumup_oauth_disconnect": ["DELETE", "/bookkeeping/payments/accounts/:accountId/sumup/oauth", "b", "frontend_permission_http", 1],
518
+ "payments_sumup_oauth_start": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/oauth/start", "b", "frontend_permission_http", 5],
519
+ "payments_sumup_sync": ["POST", "/bookkeeping/payments/accounts/:accountId/sumup/sync", "b", "frontend_permission_http", 3],
520
+ "payments_transfer_link": ["POST", "/bookkeeping/payments/transfer/link", "b", "frontend_permission_http", 4],
521
+ "payments_transfer_linkable": ["GET", "/bookkeeping/payments/:paymentId/transfer/linkable", "b", "frontend_permission_http", 3],
522
+ "payments_transfer_unlink": ["POST", "/bookkeeping/payments/:paymentId/transfer/unlink", "b", "frontend_permission_http", 5],
523
+ "payments_unallocate": ["DELETE", "/bookkeeping/payments/allocations/:paymentId/:allocationId", "b", "frontend_permission_http", 1],
524
+ "payments_update": ["PUT", "/bookkeeping/payments/update/:paymentId", "b", "frontend_permission_http", 5],
525
+ "payments_update_account": ["PUT", "/bookkeeping/payments/accounts/update/:accountId", "b", "frontend_permission_http", 5],
526
+ "payments_update_fee_vat_treatment": ["PUT", "/bookkeeping/payments/accounts/:accountId/fee-vat-treatment", "b", "frontend_permission_http", 5],
527
+ "payments_update_import_profile": ["PUT", "/bookkeeping/payments/import/profiles/:id", "b", "frontend_permission_http", 5],
528
+ "payments_void_balance_snapshot": ["POST", "/bookkeeping/payments/snapshots/:snapshotId/void", "b", "frontend_permission_http", 5],
529
+ "payments_writeoff": ["POST", "/bookkeeping/payments/:paymentId/writeoff", "b", "frontend_permission_http", 5],
530
+ "permissions_assign_to_role": ["POST", "/permissions/assign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
531
+ "permissions_assignments_list": ["GET", "/permissions/getAssignments", "b", "composite_and", 2],
532
+ "permissions_create": ["POST", "/permissions/create", "b", "frontend_permission_http", 4],
533
+ "permissions_list": ["GET", "/permissions/getAll", "b", "frontend_permission_http", 2],
534
+ "permissions_sync": ["POST", "/permissions/sync", "b", "frontend_permission_http", 2],
535
+ "permissions_unassign_from_role": ["DELETE", "/permissions/unassign/:roleId/:permissionId", "b", "frontend_permission_http", 1],
536
+ "reconciliation_auto_match_confirm": ["POST", "/bookkeeping/reconciliation/auto-match/confirm", "b", "frontend_permission_http", 4],
537
+ "reconciliation_auto_match_preview": ["GET", "/bookkeeping/reconciliation/auto-match/preview", "b", "frontend_permission_http", 2],
538
+ "reconciliation_batch_suggestions": ["POST", "/bookkeeping/reconciliation/batch-suggestions", "b", "frontend_permission_http", 4],
539
+ "reconciliation_confirm_provider_payout": ["POST", "/bookkeeping/reconciliation/confirm-provider-payout", "b", "frontend_permission_http", 4],
540
+ "reconciliation_dashboard": ["GET", "/bookkeeping/reconciliation/dashboard", "b", "frontend_permission_http", 2],
541
+ "reconciliation_groups": ["GET", "/bookkeeping/reconciliation/groups", "b", "frontend_permission_http", 2],
542
+ "reconciliation_queue": ["GET", "/bookkeeping/reconciliation/queue", "b", "frontend_permission_http", 2],
543
+ "role_assignments_create": ["POST", "/role-assignments/create/:userId/:roleId", "b", "frontend_permission_http", 5],
544
+ "role_assignments_get_user_assignments": ["GET", "/role-assignments/getUserAssignments/:userId", "b", "frontend_permission_http", 1],
545
+ "role_assignments_list": ["GET", "/role-assignments/getAll", "b", "frontend_permission_http", 2],
546
+ "role_assignments_revoke": ["DELETE", "/role-assignments/delete/:userId/:roleId", "b", "frontend_permission_http", 1],
547
+ "roles_create": ["POST", "/roles/create", "b", "frontend_permission_http", 4],
548
+ "roles_delete": ["DELETE", "/roles/delete/:roleId", "b", "frontend_permission_http", 1],
549
+ "roles_get_by_id": ["GET", "/roles/getById/:roleId", "b", "frontend_permission_http", 1],
550
+ "roles_list": ["GET", "/roles/getAll", "b", "frontend_permission_http", 2],
551
+ "roles_update": ["PUT", "/roles/update/:roleId", "b", "frontend_permission_http", 5],
552
+ "settings_list": ["GET", "/settings/getAll", "b", "frontend_bearer_http", 2],
553
+ "settings_update": ["PUT", "/settings/update/:settingId/:key", "b", "frontend_permission_http", 5],
554
+ "user_activity_overview_get": ["POST", "/user-activity/user/:userId", "b", "frontend_permission_http", 5],
555
+ "user_activity_users_stats_list": ["GET", "/user-activity/users", "b", "frontend_permission_http", 2],
556
+ "users_create": ["POST", "/users/create", "b", "frontend_bearer_http", 4],
557
+ "users_delete": ["DELETE", "/users/delete/:userId", "b", "frontend_permission_http", 1],
558
+ "users_delete_external": ["DELETE", "/users/delete/external/:frontendUserId", "b", "frontend_bearer_http", 1],
559
+ "users_get_by_email": ["GET", "/users/getByEmail/:email", "b", "frontend_permission_http", 1],
560
+ "users_get_by_external_user_id": ["GET", "/users/getByExternalUserId/:externalUserId", "b", "frontend_bearer_http", 1],
561
+ "users_get_by_id": ["GET", "/users/getById/:userId", "b", "frontend_bearer_http", 3],
562
+ "users_list": ["GET", "/users/getAll", "b", "frontend_permission_http", 2],
563
+ "users_search": ["GET", "/users/search", "b", "frontend_permission_http", 2],
564
+ "users_update_external": ["PUT", "/users/update/external/:frontendUserId", "b", "frontend_bearer_http", 5],
565
+ "webhooks_delete": ["DELETE", "/webhooks/delete/:webhookId", "b", "frontend_permission_http", 1],
566
+ "webhooks_delete_bulk": ["DELETE", "/webhooks/delete/mass/:webhookIds", "b", "frontend_permission_http", 1],
567
+ "webhooks_list": ["GET", "/webhooks/getAll", "b", "frontend_permission_http", 2],
568
+ "work_tracking_approve": ["POST", "/apps/admin/work-tracking/approve/:workEntryId", "b", "frontend_permission_http", 5],
569
+ "work_tracking_assignment_create": ["POST", "/apps/admin/work-tracking/assignments/create", "b", "frontend_permission_http", 4],
570
+ "work_tracking_assignment_delete": ["DELETE", "/apps/admin/work-tracking/assignments/delete/:workEntryAssignmentId", "b", "frontend_permission_http", 1],
571
+ "work_tracking_assignment_update": ["PUT", "/apps/admin/work-tracking/assignments/update/:workEntryAssignmentId", "b", "frontend_permission_http", 5],
572
+ "work_tracking_bill": ["POST", "/apps/admin/work-tracking/bill", "b", "frontend_permission_http", 4],
573
+ "work_tracking_bill_preview": ["POST", "/apps/admin/work-tracking/bill/preview", "b", "frontend_permission_http", 4],
574
+ "work_tracking_create": ["POST", "/apps/admin/work-tracking/create", "b", "frontend_permission_http", 4],
575
+ "work_tracking_delete": ["DELETE", "/apps/admin/work-tracking/delete/:workEntryId", "b", "frontend_permission_http", 1],
576
+ "work_tracking_get_by_id": ["GET", "/apps/admin/work-tracking/byId/:workEntryId", "b", "frontend_permission_http", 1],
577
+ "work_tracking_get_my_role": ["GET", "/apps/admin/work-tracking/my-role", "b", "frontend_permission_http", 2],
578
+ "work_tracking_list": ["GET", "/apps/admin/work-tracking/list", "b", "frontend_permission_http", 2],
579
+ "work_tracking_reject": ["POST", "/apps/admin/work-tracking/reject/:workEntryId", "b", "frontend_permission_http", 5],
580
+ "work_tracking_update": ["PUT", "/apps/admin/work-tracking/update/:workEntryId", "b", "frontend_permission_http", 5]
581
+ };
582
+
583
+ // src/operations.ts
584
+ var API_KEY_AUTH_TYPES = /* @__PURE__ */ new Set(["x_api_key_http", "x_api_key_https"]);
585
+ var PUBLIC_AUTH_TYPES = /* @__PURE__ */ new Set(["public"]);
586
+ var VALIDATES_PARAMS = 1;
587
+ var VALIDATES_QUERY = 2;
588
+ var VALIDATES_BODY = 4;
589
+ var CHANNEL_BY_CODE = {
590
+ b: "bearer",
591
+ k: "api_key",
592
+ n: "none"
593
+ };
594
+ function authChannelForContractType(authType) {
595
+ if (!authType) return "bearer";
596
+ if (API_KEY_AUTH_TYPES.has(authType)) return "api_key";
597
+ if (PUBLIC_AUTH_TYPES.has(authType)) return "none";
598
+ return "bearer";
599
+ }
600
+ function toOperation(operationId, entry) {
601
+ const [method, path, channelCode, authType, validated, scopes] = entry;
602
+ return {
603
+ operationId,
604
+ method,
605
+ path,
606
+ authType,
607
+ // Der Code in der Tabelle ist bereits das Ergebnis von
608
+ // `authChannelForContractType` zur Erzeugungszeit; faellt er unbekannt aus,
609
+ // gilt dieselbe Regel noch einmal statt einer stillen Voreinstellung.
610
+ channel: CHANNEL_BY_CODE[channelCode] ?? authChannelForContractType(authType),
611
+ validated: {
612
+ params: (validated & VALIDATES_PARAMS) !== 0,
613
+ query: (validated & VALIDATES_QUERY) !== 0,
614
+ body: (validated & VALIDATES_BODY) !== 0
615
+ },
616
+ scopes: scopes ? [...scopes] : []
617
+ };
618
+ }
619
+ var cachedOperations = null;
620
+ function listOperations() {
621
+ if (!cachedOperations) {
622
+ cachedOperations = Object.entries(ROUTE_INDEX).map(
623
+ ([operationId, entry]) => toOperation(operationId, entry)
624
+ );
625
+ }
626
+ return cachedOperations;
627
+ }
628
+ function describeOperation(operationId) {
629
+ const entry = ROUTE_INDEX[operationId];
630
+ return entry ? toOperation(operationId, entry) : null;
631
+ }
632
+ var cachedPathIndex = null;
633
+ function pathIndex() {
634
+ if (cachedPathIndex) return cachedPathIndex;
635
+ const index = /* @__PURE__ */ new Map();
636
+ for (const operation of listOperations()) {
637
+ const segments = splitPath(operation.path);
638
+ const key = `${operation.method} ${segments.length}`;
639
+ const bucket = index.get(key);
640
+ if (bucket) bucket.push({ segments, operation });
641
+ else index.set(key, [{ segments, operation }]);
642
+ }
643
+ cachedPathIndex = index;
644
+ return index;
645
+ }
646
+ function splitPath(path) {
647
+ return path.split("/").filter((segment) => segment.length > 0);
648
+ }
649
+ function resolveOperation(method, path) {
650
+ const wanted = splitPath(path.split("?")[0] ?? path);
651
+ const bucket = pathIndex().get(`${method.toUpperCase()} ${wanted.length}`);
652
+ if (!bucket) return null;
653
+ let best = null;
654
+ for (const entry of bucket) {
655
+ let score = 0;
656
+ let matches = true;
657
+ for (let i = 0; i < wanted.length; i++) {
658
+ const template = entry.segments[i];
659
+ if (template.startsWith(":")) continue;
660
+ if (template === decodeSegment(wanted[i])) score++;
661
+ else {
662
+ matches = false;
663
+ break;
664
+ }
665
+ }
666
+ if (!matches) continue;
667
+ if (!best || score > best.score) best = { score, operation: entry.operation };
668
+ }
669
+ return best?.operation ?? null;
670
+ }
671
+ function decodeSegment(segment) {
672
+ try {
673
+ return decodeURIComponent(segment);
674
+ } catch {
675
+ return segment;
676
+ }
677
+ }
678
+ var OrvelloOperationError = class extends Error {
679
+ constructor(message, operationId) {
680
+ super(message);
681
+ this.operationId = operationId;
682
+ this.name = "OrvelloOperationError";
683
+ }
684
+ operationId;
685
+ };
686
+ function buildPath(operationId, params) {
687
+ const operation = describeOperation(operationId);
688
+ if (!operation) {
689
+ throw new OrvelloOperationError(
690
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against.`,
691
+ operationId
692
+ );
693
+ }
694
+ return "/" + splitPath(operation.path).map((segment) => {
695
+ if (!segment.startsWith(":")) return segment;
696
+ const name = segment.slice(1);
697
+ const value = params?.[name];
698
+ if (value === void 0 || value === null || value === "") {
699
+ throw new OrvelloOperationError(
700
+ `orvello operation "${operationId}" needs the path parameter "${name}" (${operation.method} ${operation.path}).`,
701
+ operationId
702
+ );
703
+ }
704
+ return encodeURIComponent(String(value));
705
+ }).join("/");
706
+ }
707
+
708
+ // src/capabilities.ts
709
+ var SDK_VERSION2 = "0.2.1" ;
710
+ var CLIENT_MANAGEMENT_OPS = [
711
+ "oauth2_external_clients_list",
712
+ "oauth2_external_clients_get",
713
+ "oauth2_external_clients_create",
714
+ "oauth2_external_clients_update",
715
+ "oauth2_external_clients_delete"
716
+ ];
717
+ var CLIENT_ROTATION_OPS = ["oauth2_external_clients_rotate"];
718
+ var GRACE_PERIOD_OPS = ["oauth2_external_clients_retire", "oauth2_external_clients_rollback"];
719
+ var REVOCATION_OPS = ["oauth2_external_clients_revoke"];
720
+ function capabilityFrom(operationIds, reasonWhenMissing) {
721
+ const present = operationIds.filter((id) => describeOperation(id) !== null);
722
+ if (present.length === operationIds.length) {
723
+ return { supported: true, operations: present };
724
+ }
725
+ const missing = operationIds.filter((id) => !present.includes(id));
726
+ return {
727
+ supported: false,
728
+ operations: present,
729
+ reason: `${reasonWhenMissing} Fehlend im Vertrag: ${missing.join(", ")}.`
730
+ };
731
+ }
732
+ function capabilityFromPrefix(prefix, reasonWhenMissing) {
733
+ const present = listOperations().filter((operation) => operation.operationId.startsWith(prefix)).map((operation) => operation.operationId);
734
+ return present.length > 0 ? { supported: true, operations: present } : { supported: false, operations: [], reason: reasonWhenMissing };
735
+ }
736
+ function orvelloCapabilities() {
737
+ const operations = listOperations();
738
+ const authChannels = { bearer: 0, api_key: 0, none: 0 };
739
+ for (const operation of operations) authChannels[operation.channel]++;
740
+ return {
741
+ service: "orvello",
742
+ sdkVersion: SDK_VERSION2,
743
+ contractSha256: CONTRACT_SHA256,
744
+ operationCount: operations.length,
745
+ authChannels,
746
+ capabilities: {
747
+ // `/health/contract` ist bewusst KEINE Vertrags-Route: der Endpunkt
748
+ // beschreibt den Vertrag und kann deshalb nicht in ihm stehen. Er gehoert
749
+ // zur Zusage dieses SDK und wird von `diagnoseOrvello` live geprueft.
750
+ contractFingerprint: {
751
+ supported: true,
752
+ operations: []
753
+ },
754
+ healthCheck: capabilityFrom(
755
+ ["app_info_health"],
756
+ "Ohne Erreichbarkeits-Endpunkt bleibt nur der Umweg ueber eine echte Anfrage."
757
+ ),
758
+ clientManagement: capabilityFrom(
759
+ CLIENT_MANAGEMENT_OPS,
760
+ "Ohne diese Routen kann ein Verwalter keine Zugaenge fuer andere Apps ausstellen."
761
+ ),
762
+ clientRotation: capabilityFrom(
763
+ CLIENT_ROTATION_OPS,
764
+ "Ohne Erneuerung ist ein einmal ausgegebenes Geheimnis dauerhaft."
765
+ ),
766
+ rotationGracePeriod: capabilityFrom(
767
+ GRACE_PERIOD_OPS,
768
+ "Ohne Rueckzug und Ruecknahme ist jede Erneuerung ein harter Schnitt."
769
+ ),
770
+ clientRevocation: capabilityFrom(
771
+ REVOCATION_OPS,
772
+ "Ohne Widerruf bleibt ein kompromittierter Zugang bis zum Ablauf gueltig."
773
+ ),
774
+ entitlements: capabilityFromPrefix(
775
+ "entitlements_",
776
+ "Dieser Vertrag kennt keine Berechtigungs-Routen."
777
+ ),
778
+ invoicing: capabilityFromPrefix(
779
+ "invoices_",
780
+ "Dieser Vertrag kennt keine Rechnungs-Routen."
781
+ ),
782
+ serverSideDryRun: {
783
+ supported: false,
784
+ operations: [],
785
+ reason: "orvello bietet keinen serverseitigen Probelauf fuer die Client-Verwaltung an (`dryRun` gibt es nur in der Buchhaltung). Nebenwirkungsfrei pruefbar ist der Weg trotzdem: `preflightOrvello` beweist Erreichbarkeit, Vertrag und Credential, ohne zu schreiben \u2014 es beweist damit die Berechtigung, nicht das Ergebnis."
786
+ }
787
+ }
788
+ };
789
+ }
790
+
791
+ // src/preflight.ts
792
+ var HEALTH_PATH = describeOperation("app_info_health")?.path ?? "/app-info/health";
793
+ function step(name, ok, detail, skipped = false) {
794
+ return { name, ok, skipped, detail };
795
+ }
796
+ async function preflightOrvello(host, operationId, options = {}) {
797
+ const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
798
+ const steps = [];
799
+ const problems = [];
800
+ const report = (extra) => ({
801
+ ok: problems.length === 0,
802
+ operationId,
803
+ method: null,
804
+ path: null,
805
+ baseUrl: null,
806
+ authChannel: null,
807
+ sideEffects: "none",
808
+ serverSideDryRun: false,
809
+ steps,
810
+ problems,
811
+ checkedAt,
812
+ ...extra
813
+ });
814
+ const operation = describeOperation(operationId);
815
+ if (!operation) {
816
+ steps.push(
817
+ step(
818
+ "operation",
819
+ false,
820
+ `Der Vertrag, gegen den dieses SDK gebaut wurde, kennt "${operationId}" nicht. Entweder ist der Name falsch, oder das SDK ist aelter als der Dienst.`
821
+ )
822
+ );
823
+ problems.push(`Unbekannte Operation "${operationId}".`);
824
+ return report({});
825
+ }
826
+ steps.push(
827
+ step(
828
+ "operation",
829
+ true,
830
+ `${operation.method} ${operation.path} (Auth laut Vertrag: ${operation.authType || "keine Angabe"} \u2192 Bahn "${operation.channel}").`
831
+ )
832
+ );
833
+ let path = null;
834
+ try {
835
+ path = buildPath(operationId, options.params);
836
+ steps.push(step("path-parameters", true, `Gerufen wuerde: ${operation.method} ${path}`));
837
+ } catch (error) {
838
+ const detail = error instanceof OrvelloOperationError ? error.message : String(error);
839
+ steps.push(step("path-parameters", false, detail));
840
+ problems.push(detail);
841
+ return report({ method: operation.method, authChannel: operation.channel });
842
+ }
843
+ const shapeProblems = [];
844
+ if (operation.validated.body && options.body === void 0) {
845
+ shapeProblems.push("Der Dienst validiert einen Body, es wurde aber keiner uebergeben.");
846
+ }
847
+ if (!operation.validated.body && options.body !== void 0) {
848
+ shapeProblems.push("Es wurde ein Body uebergeben, den diese Route nicht auswertet.");
849
+ }
850
+ if (operation.validated.query && options.query === void 0) {
851
+ shapeProblems.push(
852
+ "Die Route validiert Query-Parameter; ohne uebergebene Werte gelten allein die Voreinstellungen des Dienstes."
853
+ );
854
+ }
855
+ if (shapeProblems.length === 0) {
856
+ steps.push(step("request-shape", true, "Body- und Query-Erwartung des Vertrags sind erfuellt."));
857
+ } else {
858
+ const hard = operation.validated.body && options.body === void 0;
859
+ steps.push(step("request-shape", !hard, shapeProblems.join(" ")));
860
+ if (hard) problems.push(shapeProblems[0]);
861
+ }
862
+ const baseUrl = await host.resolveBaseUrl().catch(() => null);
863
+ if (!baseUrl) {
864
+ steps.push(step("reachable", false, "Die Basis-URL des Dienstes konnte nicht aufgeloest werden."));
865
+ problems.push("Basis-URL nicht aufloesbar.");
866
+ return report({ method: operation.method, path, authChannel: operation.channel });
867
+ }
868
+ const timeoutMs = options.timeoutMs ?? 8e3;
869
+ const reachable = await probeReachable(host, baseUrl, timeoutMs, options.signal);
870
+ steps.push(step("reachable", reachable.ok, reachable.detail));
871
+ if (!reachable.ok) {
872
+ problems.push(reachable.detail);
873
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
874
+ }
875
+ const diagnosis = await diagnoseOrvello({
876
+ baseUrl,
877
+ fetch: host.fetchImpl(),
878
+ timeoutMs,
879
+ signal: options.signal
880
+ });
881
+ if (diagnosis.contract.status === "match") {
882
+ steps.push(step("contract", true, `Vertrag stimmt ueberein (${diagnosis.contract.sdk.slice(0, 12)}).`));
883
+ } else if (diagnosis.contract.status === "drift") {
884
+ const detail = diagnosis.problems[0] ?? "Vertrags-Abweichung zwischen SDK und Dienst.";
885
+ steps.push(step("contract", false, detail));
886
+ problems.push(detail);
887
+ } else {
888
+ steps.push(
889
+ step(
890
+ "contract",
891
+ false,
892
+ diagnosis.problems[0] ?? "Der Vertrag der Gegenstelle konnte nicht ermittelt werden.",
893
+ true
894
+ )
895
+ );
896
+ }
897
+ if (operation.channel === "none") {
898
+ steps.push(step("credential-configured", true, "Die Route ist oeffentlich und braucht kein Credential.", true));
899
+ steps.push(step("credential-accepted", true, "Entfaellt: oeffentliche Route.", true));
900
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
901
+ }
902
+ const configured = await host.hasCredentialFor(operation.channel);
903
+ const channelName = operation.channel === "api_key" ? "der Verwaltungs-Schluessel (Header `x-api-key`)" : "das Bearer-Credential (OAuth2-Client oder Token)";
904
+ steps.push(
905
+ step(
906
+ "credential-configured",
907
+ configured,
908
+ configured ? `${channelName} ist hinterlegt.` : `${channelName} fehlt. Diese Route ist ohne ihn nicht aufrufbar.`
909
+ )
910
+ );
911
+ if (!configured) {
912
+ problems.push(`Kein Credential fuer die Bahn "${operation.channel}" hinterlegt.`);
913
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
914
+ }
915
+ if (options.skipCredentialProbe) {
916
+ steps.push(
917
+ step("credential-accepted", false, "Auf Wunsch uebersprungen \u2014 hinterlegt ist nicht angenommen.", true)
918
+ );
919
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
920
+ }
921
+ const accepted = await host.probeCredential(operation.channel, options.signal);
922
+ steps.push(step("credential-accepted", accepted.ok, accepted.detail));
923
+ if (!accepted.ok) problems.push(accepted.detail);
924
+ return report({ method: operation.method, path, baseUrl, authChannel: operation.channel });
925
+ }
926
+ async function probeReachable(host, baseUrl, timeoutMs, signal) {
927
+ const doFetch = host.fetchImpl();
928
+ const controller = new AbortController();
929
+ const onAbort = () => controller.abort(signal?.reason);
930
+ signal?.addEventListener("abort", onAbort, { once: true });
931
+ if (signal?.aborted) controller.abort(signal.reason);
932
+ const timer = setTimeout(() => controller.abort(new Error(`Reachability probe timed out after ${timeoutMs}ms`)), timeoutMs);
933
+ const started = Date.now();
934
+ try {
935
+ const response = await doFetch(`${baseUrl}${HEALTH_PATH}`, {
936
+ method: "GET",
937
+ headers: { accept: "application/json" },
938
+ signal: controller.signal
939
+ });
940
+ const took = Date.now() - started;
941
+ return {
942
+ ok: response.status < 500,
943
+ detail: response.status < 500 ? `${baseUrl} antwortet (${response.status}, ${took} ms).` : `${baseUrl} antwortet mit ${response.status} \u2014 der Dienst laeuft, aber nicht gesund.`
944
+ };
945
+ } catch (error) {
946
+ const detail = error instanceof Error ? error.message : String(error);
947
+ return { ok: false, detail: `${baseUrl} ist nicht erreichbar: ${detail}` };
948
+ } finally {
949
+ clearTimeout(timer);
950
+ signal?.removeEventListener("abort", onAbort);
951
+ }
952
+ }
953
+
184
954
  // src/client.ts
185
955
  var OrvelloApiError = class extends Error {
186
956
  constructor(status, statusText, endpoint, body, message) {
@@ -204,14 +974,20 @@ var OrvelloApiError = class extends Error {
204
974
  return this.body;
205
975
  }
206
976
  };
207
- var OrvelloClient = class {
977
+ var OrvelloClient = class _OrvelloClient {
208
978
  baseUrl;
209
979
  auth;
980
+ managementApiKey;
981
+ extraHeaders;
210
982
  doFetch;
211
983
  timeoutMs;
212
984
  maxRetries;
213
985
  retryBaseDelayMs;
214
986
  cachedOAuthToken = null;
987
+ breakerThreshold;
988
+ breakerCooldownMs;
989
+ breakerFailures = 0;
990
+ breakerLastFailureAt = null;
215
991
  // Cached default bank account (5 minutes TTL)
216
992
  _bankAccountCache = null;
217
993
  _bankAccountCacheTime = 0;
@@ -228,10 +1004,19 @@ var OrvelloClient = class {
228
1004
  } else {
229
1005
  this.auth = this.envAuth();
230
1006
  }
1007
+ this.managementApiKey = config.managementApiKey ?? this.envManagementApiKey();
1008
+ this.extraHeaders = config.headers;
231
1009
  this.doFetch = config.fetch || globalThis.fetch;
232
1010
  this.timeoutMs = config.timeoutMs ?? 15e3;
233
1011
  this.maxRetries = config.maxRetries ?? 3;
234
1012
  this.retryBaseDelayMs = config.retryBaseDelayMs ?? 500;
1013
+ if (config.circuitBreaker === false) {
1014
+ this.breakerThreshold = Number.POSITIVE_INFINITY;
1015
+ this.breakerCooldownMs = 0;
1016
+ } else {
1017
+ this.breakerThreshold = config.circuitBreaker?.threshold ?? 5;
1018
+ this.breakerCooldownMs = config.circuitBreaker?.cooldownMs ?? 6e4;
1019
+ }
235
1020
  }
236
1021
  envBaseUrl() {
237
1022
  if (typeof process === "undefined" || !process?.env) return void 0;
@@ -250,10 +1035,31 @@ var OrvelloClient = class {
250
1035
  if (apiKey) return { apiKey };
251
1036
  return void 0;
252
1037
  }
1038
+ envManagementApiKey() {
1039
+ if (typeof process === "undefined" || !process?.env) return void 0;
1040
+ const key = process.env.ORVELLO_MANAGEMENT_API_KEY;
1041
+ return key && key !== "todo" ? key : void 0;
1042
+ }
253
1043
  async resolveBaseUrl() {
254
1044
  const val = typeof this.baseUrl === "function" ? await this.baseUrl() : this.baseUrl;
255
1045
  return val.replace(/\/+$/, "");
256
1046
  }
1047
+ static async resolveValue(provider) {
1048
+ if (provider === void 0) return void 0;
1049
+ return typeof provider === "function" ? await provider() : provider;
1050
+ }
1051
+ /**
1052
+ * Der Verwaltungs-Schluessel, sofern hinterlegt.
1053
+ *
1054
+ * Ein leerer String zaehlt als "nicht hinterlegt". Sonst waere die haeufigste
1055
+ * Fehlkonfiguration — eine gesetzte, aber leere Umgebungsvariable — von einem
1056
+ * echten Wert nicht zu unterscheiden, und der Fehler kaeme erst als `403` vom
1057
+ * Dienst zurueck.
1058
+ */
1059
+ async resolveManagementApiKey() {
1060
+ const key = (await _OrvelloClient.resolveValue(this.managementApiKey))?.trim();
1061
+ return key ? key : void 0;
1062
+ }
257
1063
  async getAuthHeader() {
258
1064
  if (!this.auth) return null;
259
1065
  if (typeof this.auth === "string") {
@@ -332,6 +1138,9 @@ var OrvelloClient = class {
332
1138
  const baseUrl = await this.resolveBaseUrl();
333
1139
  const cleanPath = path.startsWith("/") ? path : `/${path}`;
334
1140
  const url = new URL(`${baseUrl}${cleanPath}`);
1141
+ const method = (options.method ?? "GET").toUpperCase();
1142
+ const authChannel = options.authChannel ?? resolveOperation(method, cleanPath)?.channel ?? "bearer";
1143
+ this.assertCircuitClosed(cleanPath);
335
1144
  if (options.query) {
336
1145
  for (const [k, v] of Object.entries(options.query)) {
337
1146
  if (v !== void 0 && v !== null) {
@@ -350,13 +1159,30 @@ var OrvelloClient = class {
350
1159
  timeoutMs
351
1160
  );
352
1161
  try {
353
- const authHeader = await this.getAuthHeader();
354
1162
  const headers = new Headers(options.headers);
355
- if (!headers.has("Accept")) {
356
- headers.set("Accept", options.rawResponse ? "*/*" : "application/json");
1163
+ const configured = await _OrvelloClient.resolveValue(this.extraHeaders);
1164
+ if (configured) {
1165
+ for (const [name, value] of Object.entries(configured)) {
1166
+ if (!headers.has(name)) headers.set(name, value);
1167
+ }
357
1168
  }
358
- if (authHeader && !headers.has("Authorization")) {
359
- headers.set("Authorization", authHeader);
1169
+ if (authChannel === "bearer") {
1170
+ const authHeader = await this.getAuthHeader();
1171
+ if (authHeader && !headers.has("Authorization")) {
1172
+ headers.set("Authorization", authHeader);
1173
+ }
1174
+ } else if (authChannel === "api_key") {
1175
+ const key = await this.resolveManagementApiKey();
1176
+ if (!key) {
1177
+ throw new OrvelloApiError(
1178
+ 0,
1179
+ "missing management credential",
1180
+ cleanPath,
1181
+ null,
1182
+ `${method} ${cleanPath} is a management route and needs the \`x-api-key\` credential. Pass \`managementApiKey\` to createOrvelloClient() or set ORVELLO_MANAGEMENT_API_KEY. It is a different value from the OAuth2 client used for the business routes.`
1183
+ );
1184
+ }
1185
+ if (!headers.has("x-api-key")) headers.set("x-api-key", key);
360
1186
  }
361
1187
  if (options.idempotencyKey && !headers.has("Idempotency-Key")) {
362
1188
  headers.set("Idempotency-Key", options.idempotencyKey);
@@ -370,7 +1196,7 @@ var OrvelloClient = class {
370
1196
  signal: controller.signal
371
1197
  });
372
1198
  if (!resp.ok) {
373
- if (resp.status === 401) {
1199
+ if (resp.status === 401 && authChannel === "bearer") {
374
1200
  const hadCachedToken = Boolean(this.cachedOAuthToken);
375
1201
  this.cachedOAuthToken = null;
376
1202
  if (hadCachedToken && attempt === 0 && attempt < maxRetries) {
@@ -385,11 +1211,14 @@ var OrvelloClient = class {
385
1211
  }
386
1212
  const apiMessage = errBody && typeof errBody === "object" && "message" in errBody && typeof errBody.message === "string" ? errBody.message : void 0;
387
1213
  const error = new OrvelloApiError(resp.status, resp.statusText, cleanPath, errBody, apiMessage);
1214
+ if (resp.status >= 500) this.recordFailure();
1215
+ else this.recordSuccess();
388
1216
  if (!this.isRetriable(resp.status, error) || attempt >= maxRetries) {
389
1217
  throw error;
390
1218
  }
391
1219
  lastError = error;
392
1220
  } else {
1221
+ this.recordSuccess();
393
1222
  const contentType = resp.headers.get("content-type") || "";
394
1223
  if (options.rawResponse || contentType.includes("application/pdf")) {
395
1224
  return await resp.blob();
@@ -412,6 +1241,7 @@ var OrvelloClient = class {
412
1241
  if (err instanceof OrvelloApiError && !this.isRetriable(err.status, err)) {
413
1242
  throw err;
414
1243
  }
1244
+ if (!(err instanceof OrvelloApiError)) this.recordFailure();
415
1245
  if (!this.isRetriable(null, err) || attempt >= maxRetries) {
416
1246
  throw err;
417
1247
  }
@@ -425,6 +1255,231 @@ var OrvelloClient = class {
425
1255
  }
426
1256
  throw lastError;
427
1257
  }
1258
+ // ── Sicherungsautomat ────────────────────────────────────────────────────
1259
+ recordSuccess() {
1260
+ this.breakerFailures = 0;
1261
+ this.breakerLastFailureAt = null;
1262
+ }
1263
+ recordFailure() {
1264
+ this.breakerFailures++;
1265
+ this.breakerLastFailureAt = Date.now();
1266
+ }
1267
+ /**
1268
+ * Ist der Dienst nach aktuellem Wissen ansprechbar?
1269
+ *
1270
+ * Antwortet ohne Netzzugriff aus dem Zustand des Automaten. Nach Ablauf der
1271
+ * Abkuehlzeit gilt er wieder als ansprechbar — der naechste echte Aufruf
1272
+ * entscheidet dann, ob das stimmt.
1273
+ */
1274
+ isAvailable() {
1275
+ if (this.breakerFailures < this.breakerThreshold) return true;
1276
+ if (this.breakerLastFailureAt === null) return true;
1277
+ return Date.now() - this.breakerLastFailureAt > this.breakerCooldownMs;
1278
+ }
1279
+ /** Der Zustand des Automaten, unverfaelscht — fuer Diagnose-Oberflaechen. */
1280
+ circuitState() {
1281
+ return {
1282
+ open: !this.isAvailable(),
1283
+ consecutiveFailures: this.breakerFailures,
1284
+ lastFailureAt: this.breakerLastFailureAt,
1285
+ threshold: this.breakerThreshold,
1286
+ cooldownMs: this.breakerCooldownMs
1287
+ };
1288
+ }
1289
+ /** Den Automaten von Hand schliessen, etwa nach einer behobenen Stoerung. */
1290
+ resetCircuit() {
1291
+ this.recordSuccess();
1292
+ }
1293
+ assertCircuitClosed(path) {
1294
+ if (this.isAvailable()) return;
1295
+ const waited = this.breakerLastFailureAt ? Date.now() - this.breakerLastFailureAt : 0;
1296
+ const remaining = Math.max(0, this.breakerCooldownMs - waited);
1297
+ throw new OrvelloApiError(
1298
+ 0,
1299
+ "circuit open",
1300
+ path,
1301
+ null,
1302
+ `orvello is not answering: ${this.breakerFailures} consecutive transport failures. Not retrying for another ${Math.ceil(remaining / 1e3)}s.`
1303
+ );
1304
+ }
1305
+ // ── Vertragsgetriebener Aufruf ───────────────────────────────────────────
1306
+ /**
1307
+ * Eine Operation des Vertrags ueber ihre `operationId` aufrufen.
1308
+ *
1309
+ * Methode, Pfad und Credential-Bahn kommen aus dem Vertrag; der Aufrufer gibt
1310
+ * nur die Werte. Das ist der Weg fuer alles, wofuer es keine getippte Methode
1311
+ * gibt — und der Weg, der bei einer neuen Route sofort mitwaechst, statt auf
1312
+ * eine Handarbeit in diesem Client zu warten.
1313
+ *
1314
+ * Der Rueckgabetyp ist bewusst offen: die genauen Typen je Operation stehen im
1315
+ * Unterpfad `@orvello/sdk/contract` und werden hier als Typ-Argument gesetzt.
1316
+ * Ein `operationId`, den der Vertrag nicht kennt, wirft sofort — nicht erst,
1317
+ * wenn der Dienst mit 404 antwortet.
1318
+ */
1319
+ async call(operationId, options = {}) {
1320
+ const operation = describeOperation(operationId);
1321
+ if (!operation) {
1322
+ throw new OrvelloOperationError(
1323
+ `Unknown orvello operation "${operationId}". It is not part of the contract this SDK was built against (@orvello/sdk speaks ${orvelloCapabilities().operationCount} operations).`,
1324
+ operationId
1325
+ );
1326
+ }
1327
+ const { params, body, ...rest } = options;
1328
+ const path = buildPath(operationId, params);
1329
+ return this.request(path, {
1330
+ ...rest,
1331
+ method: operation.method,
1332
+ authChannel: rest.authChannel ?? operation.channel,
1333
+ ...body === void 0 ? {} : { body: JSON.stringify(body) }
1334
+ });
1335
+ }
1336
+ // ── Zustand und Faehigkeiten ─────────────────────────────────────────────
1337
+ /**
1338
+ * Steht der Dienst, und wird unser Credential angenommen?
1339
+ *
1340
+ * ⭐ `available` und `authenticated` sind zwei Fragen, und der Bericht haelt sie
1341
+ * auseinander. Ein Dienst, der laeuft, aber unser Credential ablehnt, ist nicht
1342
+ * "verfuegbar" im Sinne dessen, der ihn benutzen will — und ein `authenticated:
1343
+ * null` heisst "nicht gefragt", nie "in Ordnung".
1344
+ */
1345
+ async checkHealth(options = {}) {
1346
+ const started = Date.now();
1347
+ const timeoutMs = options.timeoutMs ?? 8e3;
1348
+ let baseUrl;
1349
+ try {
1350
+ baseUrl = await this.resolveBaseUrl();
1351
+ } catch (error) {
1352
+ return {
1353
+ available: false,
1354
+ responseTimeMs: Date.now() - started,
1355
+ authenticated: null,
1356
+ error: error instanceof Error ? error.message : String(error)
1357
+ };
1358
+ }
1359
+ const controller = new AbortController();
1360
+ const onAbort = () => controller.abort(options.signal?.reason);
1361
+ options.signal?.addEventListener("abort", onAbort, { once: true });
1362
+ if (options.signal?.aborted) controller.abort(options.signal.reason);
1363
+ const timer = setTimeout(() => controller.abort(new Error(`Health check timed out after ${timeoutMs}ms`)), timeoutMs);
1364
+ try {
1365
+ const response = await this.doFetch(`${baseUrl}${HEALTH_PATH}`, {
1366
+ method: "GET",
1367
+ headers: { accept: "application/json" },
1368
+ signal: controller.signal
1369
+ });
1370
+ if (response.status >= 500) {
1371
+ this.recordFailure();
1372
+ return {
1373
+ available: false,
1374
+ responseTimeMs: Date.now() - started,
1375
+ authenticated: null,
1376
+ error: `orvello answered ${response.status} on ${HEALTH_PATH}`
1377
+ };
1378
+ }
1379
+ this.recordSuccess();
1380
+ } catch (error) {
1381
+ this.recordFailure();
1382
+ return {
1383
+ available: false,
1384
+ responseTimeMs: Date.now() - started,
1385
+ authenticated: null,
1386
+ error: error instanceof Error ? error.message : String(error)
1387
+ };
1388
+ } finally {
1389
+ clearTimeout(timer);
1390
+ options.signal?.removeEventListener("abort", onAbort);
1391
+ }
1392
+ if (!this.auth) {
1393
+ return { available: true, responseTimeMs: Date.now() - started, authenticated: null };
1394
+ }
1395
+ try {
1396
+ const header = await this.getAuthHeader();
1397
+ return {
1398
+ available: true,
1399
+ responseTimeMs: Date.now() - started,
1400
+ authenticated: Boolean(header)
1401
+ };
1402
+ } catch (error) {
1403
+ return {
1404
+ available: true,
1405
+ responseTimeMs: Date.now() - started,
1406
+ authenticated: false,
1407
+ error: error instanceof Error ? error.message : String(error)
1408
+ };
1409
+ }
1410
+ }
1411
+ /** Was der Vertrag hergibt — ohne Netz, ohne Credential. */
1412
+ capabilities() {
1413
+ return orvelloCapabilities();
1414
+ }
1415
+ /** Spricht die laufende Gegenstelle denselben Vertrag wie dieses SDK? */
1416
+ async diagnose(options = {}) {
1417
+ return diagnoseOrvello({
1418
+ baseUrl: this.baseUrl,
1419
+ fetch: this.doFetch,
1420
+ ...options
1421
+ });
1422
+ }
1423
+ /**
1424
+ * Wuerde dieser Aufruf heute klappen? Prueft den ganzen Weg — Erreichbarkeit,
1425
+ * Vertrag, Credential — und schreibt dabei nichts.
1426
+ *
1427
+ * Gedacht fuer Verbindungs-Verwalter: eine Kante laesst sich damit turnusmaessig
1428
+ * nachpruefen, ohne sie anzufassen, und vor einem freigegebenen Schreibschritt
1429
+ * laesst sich zeigen, was er tun wuerde.
1430
+ */
1431
+ async preflight(operationId, options = {}) {
1432
+ const host = {
1433
+ resolveBaseUrl: () => this.resolveBaseUrl(),
1434
+ fetchImpl: () => this.doFetch,
1435
+ hasCredentialFor: async (channel) => {
1436
+ if (channel === "none") return true;
1437
+ if (channel === "api_key") return Boolean(await this.resolveManagementApiKey());
1438
+ return Boolean(this.auth);
1439
+ },
1440
+ probeCredential: (channel, signal) => this.probeCredential(channel, signal)
1441
+ };
1442
+ const report = await preflightOrvello(host, operationId, options);
1443
+ return {
1444
+ ...report,
1445
+ serverSideDryRun: this.capabilities().capabilities.serverSideDryRun.supported
1446
+ };
1447
+ }
1448
+ /**
1449
+ * Ein ausschliesslich lesender Aufruf auf einer Credential-Bahn.
1450
+ *
1451
+ * Je Bahn die guenstigste Frage, die ohne Nebenwirkung beantwortet, ob das
1452
+ * Credential angenommen wird:
1453
+ * - `api_key` → die Auflistung der Zugaenge mit `pageSize=1`
1454
+ * - `bearer` → das Holen des Tokens (der Dienst prueft dabei Kennung und Geheimnis)
1455
+ */
1456
+ async probeCredential(channel, signal) {
1457
+ if (channel === "none") return { ok: true, detail: "Oeffentliche Route, kein Credential noetig." };
1458
+ if (channel === "api_key") {
1459
+ try {
1460
+ await this.call("oauth2_external_clients_list", {
1461
+ query: { pageSize: 1 },
1462
+ maxRetries: 0,
1463
+ signal
1464
+ });
1465
+ return { ok: true, detail: "Der Verwaltungs-Schluessel wird angenommen (Leseprobe auf die Zugangsliste)." };
1466
+ } catch (error) {
1467
+ if (error instanceof OrvelloApiError) {
1468
+ return {
1469
+ ok: false,
1470
+ detail: error.status === 403 || error.status === 401 ? `Der Verwaltungs-Schluessel wird abgelehnt (${error.status}). Der Wert ist gesetzt, aber nicht der, den der Dienst erwartet.` : `Leseprobe fehlgeschlagen (${error.status}): ${error.message}`
1471
+ };
1472
+ }
1473
+ return { ok: false, detail: `Leseprobe fehlgeschlagen: ${error.message}` };
1474
+ }
1475
+ }
1476
+ try {
1477
+ const header = await this.getAuthHeader();
1478
+ return header ? { ok: true, detail: "Das Bearer-Credential wird angenommen (Token wurde ausgestellt)." } : { ok: false, detail: "Es konnte kein Bearer-Credential ermittelt werden." };
1479
+ } catch (error) {
1480
+ return { ok: false, detail: `Token konnte nicht geholt werden: ${error.message}` };
1481
+ }
1482
+ }
428
1483
  // ── Invoices ─────────────────────────────────────────────────────────────
429
1484
  invoices = {
430
1485
  search: (query, options) => this.request("/invoices/external", {
@@ -732,6 +1787,6 @@ function createOrvelloClient(config) {
732
1787
  return new OrvelloClient(config);
733
1788
  }
734
1789
 
735
- export { CONTRACT_SHA256, OrvelloApiError, OrvelloClient, buildBase64Receipt, calculateVat, createOrvelloClient, diagnoseOrvello, formatAmount, isKleinunternehmer, mapPaymentAccountToBankDetails };
1790
+ export { CONTRACT_SHA256, HEALTH_PATH, OrvelloApiError, OrvelloClient, OrvelloOperationError, authChannelForContractType, buildBase64Receipt, buildPath, calculateVat, createOrvelloClient, describeOperation, diagnoseOrvello, formatAmount, isKleinunternehmer, listOperations, mapPaymentAccountToBankDetails, orvelloCapabilities, preflightOrvello, resolveOperation };
736
1791
  //# sourceMappingURL=index.js.map
737
1792
  //# sourceMappingURL=index.js.map